HTML escape in internationalized message

Hi,

Recently I've noticed some strange thing in template mechanism (XSS bug?).
I mean: when I write an action like this:

public static void someAction(String xssAtack)
{
	// xssAtack == "<script>alert(1)</script>";
        render("main.html", xssAtack);
}

and in messages file: myText=XSS %s

and in main.html: &{'myText', xssAtack}

this causes showing the alert! Shouldn't message parameter be auto HTML-escaped? I think it can be a security hole in PF. Am I right?

Of course, when I do in main.html: ${xssAtack}

variable "xssAtack" will be escaped correct, according to documentation:

All dynamic expressions are escaped by the template engine to avoid XSS security issues in your application.

I know of course that I can escape every String I put in renderArgs by hand. If I have simple Strings is not a problem but what if I have a "big" object with objects as field and so on...?

So my question is: shouldn't the template engine do escaping the internationalized message as well as expressions?